CND (312-38) Network Defense Simulation

Welcome to this Network Defense simulation focusing on defense-in-depth strategies and operational approaches. You will analyze a SOC manager's workflow within a SIEM environment to correctly categorize the type of network defense approach being utilized.

Network Scenario

You are an analyst in an enterprise Security Operations Center (SOC). A serious data breach occurred over the weekend. The incident has already been contained, and the compromised systems have been isolated from the network.

Now, the SOC Manager is logged into AlienVault USM (Unified Security Management) to piece together the attack chain. They are querying historical firewall, IDS, and authentication logs to determine exactly how the attackers bypassed the perimeter and moved laterally.

Traffic & Logs

[ALIENVAULT USM - HISTORICAL LOG SEARCH] Query Engine: event_type:"authentication" OR event_type:"exploit" AND src_ip:"185.15.x.x" Time Range: Last 72 Hours Timestamp Sensor Event Name Src IP Dst IP ------------------- ---------- ---------------------------- ------------ ---------- 2023-10-12 03:14:02 Edge-FW-01 SSH Brute Force Success 185.15.59.22 10.10.5.50 2023-10-12 03:15:45 HIDS-01 Privilege Escalation (sudo) 10.10.5.50 10.10.5.50 2023-10-12 03:22:10 Core-IDS Lateral Movement (SMB) 10.10.5.50 10.10.5.12 2023-10-12 03:45:00 Core-RTR Large Outbound Transfer 10.10.5.12 185.15.59.22 [SOC ANALYST NOTES] Status: Investigation Phase Objective: Aggregate historical logs to identify the root cause (compromised SSH credentials) and assess the scope of the lateral movement to patch the vulnerability.

Question

The SOC manager is reviewing logs in AlienVault USM to investigate an intrusion on the network. Which CND approach is being used?

Look at the time context. The manager is reviewing historical logs for an intrusion that has already been contained. They are looking back in time to investigate.

Expert Analysis

1. What is happening in the network

The network experienced a breach 72 hours ago. The SOC Manager is now utilizing AlienVault USM to correlate events from the Edge Firewall, Host IDS, and Core Router to map out the attacker's timeline, identifying SSH brute force and subsequent lateral movement.

2. Identify attack or behavior

The behavior here is post-incident analysis. The manager is not actively fighting off an attacker; they are conducting a forensic log review. This is an administrative and investigative action, not a real-time technical mitigation.

3. Why correct answer is correct

Retrospective defense relies on the ability to look back at network activity to understand a compromise. Without robust logging (syslog, NetFlow, event logs) centralized into a SIEM, retrospective defense is impossible. It answers the questions: "How did they get in?", "What did they take?", and "How do we stop it next time?"

4. Why others are wrong

Reactive is responding to a current, active threat. Preventive is stopping the threat at the perimeter before compromise. Deterrent is putting up psychological barriers to prevent the attempt. Because the event is in the past, it must be Retrospective.

5. Defensive action

The outcome of a retrospective investigation must feed back into Preventive controls. In this scenario, discovering that SSH was successfully brute-forced will lead the defender to implement new Preventive controls: deploying Multi-Factor Authentication (MFA), enforcing rate-limiting (fail2ban), or restricting SSH access to a dedicated management VPN.

6. MINI LESSON: The Defense Triad

Preventive (Before): Firewalls, Hardening, Patch Management.
Reactive (During): IPS blocking exploit signatures, SOC Analysts isolating compromised endpoints, EDR killing malicious processes.
Retrospective (After): SIEM log analysis, Digital Forensics, PCAP review, Incident Post-Mortem.

Ready to master Network Defense?

Practice with hundreds of realistic scenarios covering firewalls, IDS/IPS, VPNs, and packet analysis.

Explore more CND simulations